This Global Privacy Policy describes how Vmemoo Limited handles personal information in connection with the Vmemoo website and mobile application, based on the features and behavior currently described by Vmemoo.
1. Introduction and how this Policy works
This Global Privacy Policy ("Policy") describes how Vmemoo Limited, trading as Vmemoo ("Vmemoo", "we", "us" or "our"), handles personal information when you use the Vmemoo website and mobile application (together, the "Service"). This Policy works alongside the Terms of Service, Community Guidelines, Memorial and Deceased-Person Policy, Copyright Policy and Safety Policy. By using the Service, you confirm that you have read this Policy. If you do not agree, do not use the Service. Nothing in this Policy excludes rights that cannot lawfully be excluded, including mandatory consumer rights.
2. Information Vmemoo handles
Depending on the feature used, Vmemoo may handle account and profile information; authentication information, including Google authentication where used; memorial and deceased-person information; user-uploaded photos and media; Prayers, comments and replies; direct messages; Stars and Stars transaction information; Welcome Gift records; push-notification registration metadata; moderation information including reports, blocking, unblocking, suspension and enforcement records; account-deletion and anonymisation records; support and privacy communications; and security and operational logs.
On supported Android devices, Vmemoo's live purchase flow may involve limited provider and transaction metadata, such as product identifiers, provider or transaction identifiers, store or environment information, timestamps, lifecycle or fulfilment states, and related transaction references, processed as necessary for verification, fulfilment, reconciliation, support, fraud and duplicate-purchase prevention, and required recordkeeping. Vmemoo's own app and backend payment flow does not store raw card numbers, CVV codes, bank-account credentials or equivalent raw payment credentials; this Policy does not describe what Google Play or RevenueCat may independently retain beyond Vmemoo's own processing. The public website does not currently install analytics, advertising or tracking SDKs.
3. How Vmemoo uses information
Vmemoo uses information where necessary to provide accounts, authentication, memorials, uploaded media, Prayers, comments, replies, direct messages, notifications, Stars and Welcome Gift records; to support reporting, blocking, unblocking, moderation and account suspension; to respond to support and privacy communications; to secure the Service and maintain operational logs; to process account deletion and later anonymisation; to comply with legal obligations; and to protect users, memorials and the Service from abuse and fraud.
The applicable legal basis depends on the purpose and context and may include performance of a contract, legitimate interests, compliance with a legal obligation or consent where consent is required. Vmemoo does not use this Policy to claim that analytics, advertising, tracking or live payment processing is active when it is not.
4. Sensitive information
Memorial content may incidentally reveal religion, health, ethnicity, sexual orientation, political views or other sensitive information about living people. Do not upload sensitive information about another living person without a lawful basis and appropriate authority. Where Vmemoo intentionally processes special-category data under EU/UK law, it will identify an Article 9 condition, apply additional controls and obtain explicit consent where that is the appropriate condition.
5. Public content and visibility
Information set to public may be viewed, copied or reshared by others and may be indexed by search engines if that feature is enabled. Privacy settings reduce platform visibility but cannot guarantee that a recipient will not capture or disclose content. The interface must clearly show the selected audience before publication.
6. Sharing and recipients
Vmemoo discloses information only as reasonably necessary to:
- Other users and the public, according to the feature and visibility selected.
- Contracted infrastructure, authentication, storage, push-notification, moderation and support providers acting only as needed for an actual Vmemoo feature and subject to appropriate safeguards.
- Professional advisers, auditors, insurers and corporate transaction participants subject to confidentiality and lawful safeguards.
- Authorities or affected parties where disclosure is legally required or reasonably necessary to protect rights, safety and security, subject to review of the request.
- Google Play and RevenueCat, solely to process and validate real-money purchases made through the live Android purchase flow described in the Terms of Service.
7. Service providers and SDKs
The public Vmemoo website does not currently use analytics, advertising, tracking or diagnostics SDKs. Vmemoo may use contracted infrastructure, authentication, storage, notification, moderation and support services required for actual features of the Service. This Policy does not claim that a provider processes data for a feature that is not live. The Vmemoo mobile application uses Google Play Billing and RevenueCat to process and validate real-money purchases on supported Android devices; this does not apply to the public marketing website, which remains as described above.
8. International transfers
Vmemoo is intended to operate internationally. Where personal data is transferred from the EEA, United Kingdom or another jurisdiction that restricts international transfers, Vmemoo will use a lawful mechanism such as an adequacy decision, approved standard contractual clauses, the UK Addendum or International Data Transfer Agreement, or another valid safeguard. A copy or summary of relevant safeguards may be requested at privacy@vmemoo.com.
9. Account deletion, anonymisation and retention
When a user initiates account deletion in the Vmemoo mobile application, the account is disabled, active sessions are invalidated and signed out, and owned memorials are unpublished or removed from normal visibility. Accounts soft-deleted for at least 30 days become eligible for irreversible anonymisation of direct account identifiers and authentication information.
- The anonymisation process is designed to strip direct account identifiers and authentication information, including applicable fields such as email, password hash, name, username, avatar, cover, biography, location, social links and Google identity linkage.
- User-generated memorial content may be unpublished or removed from normal visibility, but Vmemoo does not promise that every record or every item of user-generated content is destroyed immediately.
- Some records may be retained only where genuinely necessary for transaction or accounting requirements, legal obligations, security, fraud prevention, moderation, abuse prevention, audit requirements, dispute handling or referential/database integrity.
- The anonymisation process is designed to be idempotent and auditable. Retained anonymised or necessary records are not treated as an active user account.
10. Security and operational records
Vmemoo uses risk-appropriate administrative, technical and organisational safeguards for the information it handles, including access controls and measures designed to protect authentication, account, memorial, messaging, moderation and operational information. No system is completely secure. Security and operational logs may be retained only as genuinely necessary for security, abuse prevention, audit, legal obligations or dispute handling.
11. Your choices and rights
Depending on location, you may have rights to access, know, correct, delete or erase, restrict or object to processing, receive portable data, withdraw consent, appeal a refusal and complain to a regulator, where applicable. You may contact privacy@vmemoo.com or use the public information at /privacy-request. We will verify identity proportionately and may request authorised-agent documentation. We will not discriminate against you for exercising an applicable right.
12. Account deletion
Account deletion can be initiated from the account/settings area of the Vmemoo mobile application. The public website page at /account-deletion provides information but does not create a website-side deletion request API. Deleting the mobile application from a device is not the same as deleting an account. For questions about deletion or retained information, contact privacy@vmemoo.com.
13. Adults-only service and information about minors
Vmemoo accounts are restricted to people aged 18 and older. We do not knowingly permit minors to hold accounts. If we learn that a minor created an account, we will restrict and delete it after appropriate review. Contact privacy@vmemoo.com to report a suspected minor account. Adults may upload appropriate memorial content that includes a minor only where they have lawful authority and respect the minor's privacy, safety, dignity and best interests. A memorial may concern a deceased child or teenager; this does not make the minor a Vmemoo account holder, and the adult account holder remains responsible for ensuring an appropriate lawful basis for the content.
14. Regional disclosures
Depending on location, additional privacy rights and complaint routes may apply. Vmemoo will provide access, correction and deletion information through the contacts and public routes described in this Policy, subject to identity verification, applicable exceptions and the law governing the request. Vmemoo does not sell or share personal information for cross-context behavioural advertising and does not knowingly permit such use for people under 18.
15. Changes and contact
Vmemoo will post updates with a revision date and provide additional notice for material changes.
Controller: Vmemoo Limited. Business/contact address: 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Privacy contact: privacy@vmemoo.com. General contact: info@vmemoo.com.